Password Generator

What makes a password strong?

Two things: length and unpredictability. A 16-character random password drawn from a large alphabet has more entropy than a 30-character predictable phrase, and brute-forcing it is impractical with current hardware. The strength meter in this tool estimates entropy in bits and grades the result accordingly.

Tips

• Pick at least 16 characters. The default is exactly that.
• Enable all four character classes when the site allows symbols. Each class roughly doubles the search space.
• Use a password manager — typing a 20-character random string by hand once a day is fine, doing it twenty times a day isn't.
• Don't reuse passwords across sites. A single breach turns into a chain reaction otherwise.

About the lookalike-character option

Some characters are easy to mix up when reading off a screen or writing on paper: lowercase L versus the digit 1, capital O versus zero, and so on. Enable that option when you'll be typing the password by hand or sharing it verbally. Skip it when you're storing it in a password manager — fewer characters means slightly less entropy for the same length.

Common password mistakes to avoid

Most accounts are not broken into by someone guessing a truly random password. They fall to predictable habits that attackers already know how to exploit:

• Personal details. Names, birthdays, pet names and favorite teams are easy to find on social media and are among the first things attackers try.
• Simple substitutions. Swapping letters for lookalike numbers or symbols, like an @ for an a, is a well-known pattern that cracking tools test automatically.
• Small variations. Adding a 1 or an exclamation mark to an old password, or changing only the year, gives very little extra protection.
• Reuse. When one site leaks your password, attackers try the same email and password combination on many other services.

A randomly generated password avoids all of these at once, because there is no pattern to guess.

Frequently asked questions about password security

What is a strong password?

A strong password is long, random and unique to a single account. Aim for at least 16 characters mixing uppercase and lowercase letters, numbers and symbols, with no words or personal information.

Is this password generator safe to use?

Yes. Passwords are generated in your browser with the WebCrypto API, which is designed for cryptographic use. Nothing is sent to a server or stored anywhere.

How long should my password be?

Longer is better. Sixteen characters is a solid default for most accounts, and you can go longer for important ones like email, banking or your password manager's master password.

How often should I change my passwords?

Current security guidance generally recommends changing a password when there is a reason to, such as a data breach or suspected compromise, rather than on a fixed schedule. A strong, unique password does not need frequent changes.

Should I use a password manager?

For most people, yes. A password manager lets you use a different random password on every site without having to remember them, which is the single most effective habit for account security.

Is two-factor authentication still necessary with a strong password?

Yes. Two-factor authentication adds a second check, such as a code from an app, so a stolen password alone is not enough to get into your account. Turn it on wherever it is available.